From 1d40423c91d08be06930c36fcd48277ac8129bbd Mon Sep 17 00:00:00 2001 From: Maximilian Mader Date: Sat, 13 Dec 2014 15:02:36 +0100 Subject: [PATCH] Improve validation in UserAction --- file/lib/data/user/UserAction.class.php | 23 +++++++++++++++-------- language/de.xml | 1 + language/en.xml | 5 +++-- template/chat.tpl | 14 ++++++++------ userGroupOption.xml | 7 +++++++ 5 files changed, 34 insertions(+), 16 deletions(-) diff --git a/file/lib/data/user/UserAction.class.php b/file/lib/data/user/UserAction.class.php index ad7b847..64857dd 100644 --- a/file/lib/data/user/UserAction.class.php +++ b/file/lib/data/user/UserAction.class.php @@ -21,7 +21,13 @@ class UserAction extends \wcf\data\AbstractDatabaseObjectAction { * Validates invite preparation. */ public function validatePrepareInvite() { - // Todo: Proper validation + WCF::getSession()->checkPermissions(array('user.chat.canInvite')); + + if (!WCF::getUser()->chatRoomID) throw new \wcf\system\exception\PermissionDeniedException(); + + $room = \chat\data\room\RoomCache::getInstance()->getRoom(WCF::getUser()->chatRoomID); + + if (!$room || !$room->canEnter()) throw new \wcf\system\exception\PermissionDeniedException(); } /** @@ -50,14 +56,15 @@ public function prepareInvite() { * Validates invites. */ public function validateInvite() { - if (!isset($this->parameters['recipients'])) throw new \wcf\system\exception\UserInputException("recipients"); + WCF::getSession()->checkPermissions(array('user.chat.canInvite')); - if (WCF::getUser()->chatRoomID) { - $this->room = \chat\data\room\RoomCache::getInstance()->getRoom(WCF::getUser()->chatRoomID); - } - else { - throw new \wcf\system\exception\UserInputException("roomID"); - } + if (!WCF::getUser()->chatRoomID) throw new \wcf\system\exception\PermissionDeniedException(); + + $this->room = \chat\data\room\RoomCache::getInstance()->getRoom(WCF::getUser()->chatRoomID); + + if (!$this->room || !$this->room->canEnter()) throw new \wcf\system\exception\PermissionDeniedException(); + + if (!isset($this->parameters['recipients'])) throw new \wcf\system\exception\UserInputException("recipients"); } /** diff --git a/language/de.xml b/language/de.xml index b79d5af..27dd04c 100644 --- a/language/de.xml +++ b/language/de.xml @@ -60,6 +60,7 @@ + diff --git a/language/en.xml b/language/en.xml index 737cc90..2ed941b 100644 --- a/language/en.xml +++ b/language/en.xml @@ -40,8 +40,8 @@ - - username}“ möchte mit Ihnen im Chatraum „{$userNotificationObject->getTitle()}“ chatten!]]> + + username}” wants to chat with you in “{$userNotificationObject->getTitle()}”!]]> @@ -60,6 +60,7 @@ + diff --git a/template/chat.tpl b/template/chat.tpl index 0d8e9c9..f3c59c8 100644 --- a/template/chat.tpl +++ b/template/chat.tpl @@ -192,12 +192,14 @@ {/if} -
  • - - - - -
    • + {if $__wcf->session->getPermission('user.chat.canInvite')} +
  • + + + + +
    • + {/if}
  • diff --git a/userGroupOption.xml b/userGroupOption.xml index 4d41e94..57e4d37 100644 --- a/userGroupOption.xml +++ b/userGroupOption.xml @@ -35,6 +35,13 @@ 1 1 +